TLS: Get a Certificate Signed by the Internal CA

The new internal API needs a TLS certificate that clients will trust. Clients trust the company's internal CA, whose certificate and key are in /etc/pki/lab-ca/ (ca.crt and ca.key). In production you would send a CSR to whoever holds that key; here you hold it, so you play both roles.

Produce and install:

1. A new private key at /etc/ssl/private/api.key (RSA 2048 bits or stronger, or an EC key), readable only by root (mode 600).

2. A certificate at /etc/ssl/certs/api.crt for that key, signed by the internal CA, valid for at least 30 more days, with subject CN api.internal.example and subject alternative names DNS:api.internal.example and DNS:api. Clients match hostnames against the SANs, not the CN, so the SANs must be in the issued certificate.

3. A chain file at /etc/ssl/certs/api-fullchain.pem that servers can hand to clients: the API certificate first, then the CA certificate.

Grading inspects the key, certificate and chain with openssl, the way a client or an auditor would.